Chapter 7

Chapter 7: Clinical Safety Monitoring and System Integration

How WIA-BIO-005 encodes cytokine release syndrome, neurotoxicity and other post-infusion adverse events, how the SDK turns observations into grades and risk levels, and where the Safety Monitor sits among the hospital and manufacturer systems it has to talk to.

Chapters 2 to 6 followed the product from the donor’s vein to the patient’s vein. At the moment of infusion the product stops being the main subject and the patient becomes it. The cells now expand inside the body, and the same property that makes them work, namely vigorous activation on meeting their target antigen, is also the source of the most characteristic toxicities of the field. A system that claims WIA-BIO-005 conformance must include a Safety Monitor (spec §8.1), and this chapter explains what that component has to know about: the grading systems it must represent faithfully, the data model that carries the observations, the risk rollup the SDK performs, and the integration fabric that moves a single adverse-event record from a bedside observation to a pharmacovigilance case and back to a manufacturing lot.

Two themes run through the chapter. The first is fidelity: when a standard adopts a published consensus scale such as the ASTCT 2019 grading, software must reproduce that scale exactly, and where the specification or SDK deviates from it, the deviation must be recognised and handled. The second is responsibility: the SDK produces grades, urgency labels and recommendation strings, but it never decides. Section 7.7 turns that principle into concrete design rules.

7.1 Cytokine Release Syndrome and Its Grading

7.1.1 What happens physiologically

When CAR-T cells engage their antigen, for example CD19 on malignant B cells, they activate, proliferate and release effector cytokines such as interferon-γ. These signals recruit and activate bystander myeloid cells, chiefly monocytes and macrophages, which amplify the response with large amounts of interleukin-6, interleukin-1 and other mediators. The amplified inflammation activates the endothelium, increases capillary permeability and can lead to fluid shifts, falling blood pressure and impaired oxygenation. Clinically this appears as fever, often the first sign, followed in more severe cases by hypotension and hypoxia. Onset typically falls within the first days after infusion, although the timing depends on the product, the disease burden and the patient. Because the syndrome is driven by the therapy’s own mechanism, its occurrence is not a sign of a manufacturing defect, and the monitoring system must record it as an expected, gradable toxicity rather than as a quality failure.

7.1.2 The ASTCT 2019 consensus grades

WIA-BIO-005 §7.1.1 adopts the consensus grading published by the American Society for Transplantation and Cellular Therapy (ASTCT) in 2019. The scale is deliberately simple. Fever of at least 38 °C is required to diagnose CRS; the grade is then set by the most severe of two findings, hypotension and hypoxia. Organ toxicities that occur alongside CRS are graded separately (commonly with the NCI Common Terminology Criteria for Adverse Events) and do not change the CRS grade.

Three details of the consensus text matter to implementers. First, fever that has been suppressed by antipyretics or anti-cytokine therapy does not end the episode: once fever has been documented, subsequent grading follows hypotension and hypoxia even if the current temperature is normal. Second, the grade is always the more severe of the two axes, so a patient with vasopressor-free hypotension (grade 2 on the pressure axis) who needs high-flow oxygen (grade 3 on the oxygen axis) is grade 3. Third, vasopressin does not count as an additional vasopressor when distinguishing grade 3 from grade 4.

7.1.3 Mapping to the CRSAssessment type

The SDK type CRSAssessment carries exactly the inputs the scale needs: temperature in °C, a hypotension flag, a three-valued vasopressors field ('none' | 'single' | 'multiple'), a hypoxia flag and a four-valued oxygenRequirement ('none' | 'low-flow' | 'high-flow' | 'ventilator'). It also holds a grade field restricted to 0–4, optional biomarkers and an optional CRSTreatment record.

Two mapping subtleties deserve explicit handling. The enum value 'ventilator' should be read as “positive-pressure support”, because non-invasive CPAP or BiPAP already qualifies as grade 4. And 'multiple' must be entered only when two or more non-vasopressin vasopressors are running; a noradrenaline infusion plus vasopressin is still 'single' for grading purposes. Writing both rules into the data-entry screen, not just into documentation, prevents the most common upgrading error.

The type does not, however, record whether fever was present earlier in the episode, which the consensus needs when fever is masked. The example in Section 7.2 passes that fact as a separate argument; a production system would derive it from the episode history.

7.1.4 Biomarkers as the specification presents them

Spec §7.1.3 lists peak CRP, ferritin, IL-6, IFN-γ and lactate values under the heading “predictive of severe CRS”, and CRSAssessment.biomarkers has slots for CRP (mg/dL), ferritin (ng/mL), IL-6 and IFN-γ (pg/mL). The specification cites no source for its thresholds, and they should be treated as illustrative values in the standard rather than validated cut-offs. Laboratory methods, reference ranges and units vary between institutions; a CRP of 12 in mg/dL is 120 in mg/L. The Safety Monitor should therefore store biomarkers with an explicit unit and trend them over time, and it must not grade CRS or trigger treatment prompts on biomarker thresholds alone. The consensus grade depends on clinical signs, not on laboratory values.

7.2 CRS Management as Encoded in the Standard

Spec §7.1.2 contains a grade-based management algorithm, and the SDK method assessCRS turns a grade into a treatment string and an urgency label. The content is summarised here so that the implementation can be verified; the reminder at the head of the chapter applies with full force.

Tocilizumab is a monoclonal antibody against the interleukin-6 receptor, and its role follows directly from the pathophysiology in Section 7.1.1: it interrupts the IL-6 amplification loop. Corticosteroids provide broader immunosuppression and enter the algorithm when CRS is severe or does not respond. Two dosing details in the specification are worded loosely and should be stated precisely in any system that displays them:

• Weight bands. The specification lists “paediatric 12 mg/kg”. The product label wording ties the higher mg/kg dose to body weight, not age: 12 mg/kg for patients under 30 kg and 8 mg/kg for patients of 30 kg and above, with a maximum of 800 mg per infusion.
• Dose limits. The specification’s “maximum 3–4 doses total” is ambiguous. The label wording is: no more than 3 doses in 24 hours, and a maximum of 4 doses in total. The assessCRS string for grade 2 says “Repeat tocilizumab q8h PRN” with no cap at all, so the cap has to come from the prescribing system, which can count CRSTreatment.tocilizumab.doses against these limits and block or warn.

All of these values apply only per the current product label and institutional protocol; the book reproduces them for verification, not as recommendations.

The listings below show one observation taken through the SDK. Note carefully what assessCRS does and does not do: it reads the grade field that the caller supplies and switches on it. It never derives a grade from temperature, vasopressors or oxygen. A system that trusts the SDK to “assess” CRS without first grading the observation will echo whatever grade was typed in. The helper gradeCRS closes that gap by applying Table 7-1 to the fields.

import { CellularTherapySDK, CRSAssessment } from '@wia/bio-005';

// Example only: one bedside observation on day 3 after infusion.
const obs: CRSAssessment = {
  patientId: 'PT-7F3A21',           // pseudonymous ID - never a name or MRN
  timestamp: new Date('2025-03-14T02:00:00Z'),
  daysPostInfusion: 3,
  grade: 0,                          // filled in by gradeCRS() below
  temperature: 38.9,                 // degrees Celsius
  hypotension: true,
  vasopressors: 'none',              // responded to a fluid bolus
  hypoxia: false,
  oxygenRequirement: 'none',
  biomarkers: { crp: 12.4, ferritin: 2150 },   // illustrative values
  notes: 'SBP recovered after 1 L crystalloid'
};

type Grade = 0 | 1 | 2 | 3 | 4;

/**
 * ASTCT 2019 CRS grade from the fields of CRSAssessment.
 * feverInEpisode: fever was documented earlier in this episode
 * (antipyretics or anti-IL-6 therapy can mask it at the current reading).
 */
function gradeCRS(a: CRSAssessment, feverInEpisode: boolean): Grade {
  const fever = a.temperature >= 38 || feverInEpisode;
  if (!fever) return 0;                       // no fever, no CRS grade
  const byPressure: Grade =
    !a.hypotension               ? 1 :
    a.vasopressors === 'none'    ? 2 :
    a.vasopressors === 'single'  ? 3 : 4;
  const byOxygen: Grade =
    a.oxygenRequirement === 'none'      ? 1 :
    a.oxygenRequirement === 'low-flow'  ? 2 :
    a.oxygenRequirement === 'high-flow' ? 3 : 4;   // 'ventilator' = positive pressure
  return Math.max(byPressure, byOxygen) as Grade;  // the more severe finding wins
}

const sdk = new CellularTherapySDK();

obs.grade = gradeCRS(obs, true);
const rec = sdk.assessCRS(obs);
console.log(rec);

// Output (SDK 1.0.0):
// {
//   grade: 2,
//   treatment: 'Tocilizumab 8 mg/kg IV (max 800 mg). Consider corticosteroids
//               if no improvement in 24h. Repeat tocilizumab q8h PRN.',
//   urgency: 'urgent'
// }

In this example the temperature of 38.9 °C establishes fever, the hypotension that responded to fluids places the pressure axis at grade 2, and the oxygen axis stays at grade 1. The overall grade is 2, and the SDK returns urgency urgent. The CLI offers the same mapping in a condensed form: wia-bio-005 monitor-safety --patient PT-001 --days 3 --crs 2 --icans 0 prints a grade 2 warning with a one-line treatment note. (The README shows the flag as --day; the script actually parses --days.) Like the SDK, the CLI accepts the grade as an input and does not compute it.

7.3 ICANS and the ICE Score

7.3.1 The clinical picture

Immune effector cell-associated neurotoxicity syndrome can accompany or follow CRS, or occur on its own. It commonly begins with subtle changes: difficulty finding words, impaired handwriting, reduced attention. In more severe cases it can progress to confusion, depressed consciousness, seizures, motor weakness and, rarely, cerebral oedema. Because early signs are easy to miss in a tired, febrile patient, the consensus approach relies on a short, repeatable bedside screen, the ICE score, combined with an assessment of the level of consciousness and specific neurological findings.

7.3.2 The ICE score, correctly defined

The Immune Effector Cell-associated Encephalopathy (ICE) score is a ten-point tool published with the ASTCT 2019 consensus. A score of 10 is normal; lower scores indicate more impairment.

/** ICE domains as defined by ASTCT 2019 (total 0-10). */
interface IceAstct {
  orientation: number;  // 0-4: year, month, city, hospital
  naming: number;       // 0-3: three objects
  commands: number;     // 0-1: follows simple commands
  writing: number;      // 0-1: writes a standard sentence
  attention: number;    // 0-1: counts back from 100 by 10
}

const clamp = (v: number, max: number) => Math.min(Math.max(Math.round(v), 0), max);

function iceScore(c: IceAstct): number {
  return clamp(c.orientation, 4) + clamp(c.naming, 3) + clamp(c.commands, 1)
       + clamp(c.writing, 1) + clamp(c.attention, 1);
}

/** Store the ASTCT domains alongside the SDK record without losing 'attention'. */
function toSdkComponents(c: IceAstct) {
  return {
    iceComponents: {
      orientation: clamp(c.orientation, 4),
      naming: clamp(c.naming, 3),
      following: clamp(c.commands, 1),   // SDK allows 0-2; ASTCT caps at 1
      writing: clamp(c.writing, 1),
    },
    iceScore: iceScore(c),               // total includes the attention point
    iceAstct: c,                         // extension field kept in your own store
  };
}

For young children who cannot complete the ICE tasks, the ASTCT consensus uses a paediatric delirium tool (the Cornell Assessment of Pediatric Delirium) in place of ICE. Neither the specification nor the SDK models this; a paediatric programme would need an extension field and its own grading rule.

7.3.3 ICANS grades

The ICANS grade is set by the most severe of five domains: the ICE score, the level of consciousness, seizures, motor findings and raised intracranial pressure or cerebral oedema. Findings attributable to another cause are excluded.

One footnote of the consensus is worth coding explicitly: an ICE score of 0 in a patient who is awake but globally aphasic is grade 3, whereas an ICE score of 0 in a patient who cannot be aroused is grade 4. The ICE score alone therefore cannot separate those two grades; the consciousness field must be consulted.

The SDK’s ICANSAssessment type captures most of the table: iceScore, consciousness ('awake' | 'awakens-to-voice' | 'awakens-to-touch' | 'unresponsive'), a seizures boolean, free-text motorFindings and a cerebralEdema boolean. Compared with the consensus, the spec’s grading text in §7.2.2 places “any clinical or subclinical seizure” at grade 3 without distinguishing prolonged seizures, and omits focal oedema at grade 3. The booleans inherit that coarseness: a single seizures: true cannot say whether the seizure resolved rapidly (grade 3) or was prolonged (grade 4), and cerebralEdema: true cannot say whether it was focal (grade 3) or diffuse (grade 4). Systems that need to grade reliably should add structured fields for seizure duration and oedema extent. As with CRS, assessICANS reads the supplied grade rather than computing one.

7.3.4 Why tocilizumab is not the answer for isolated ICANS

Spec §7.2.3 and the grade 3–4 string of assessICANS both say to avoid tocilizumab. The reasoning is mechanistic. Tocilizumab blocks the IL-6 receptor, and receptor blockade can transiently raise circulating IL-6 because the cytokine is no longer being cleared through its receptor; the antibody itself is thought to cross into the central nervous system poorly. The concern is that more free IL-6 may reach the brain while the drug does not. For that reason corticosteroids, rather than anti-IL-6 therapy, are the mainstay for ICANS without concurrent CRS in the consensus-era approach. The standard encodes grade 2 as dexamethasone with consideration of anti-seizure prophylaxis (levetiracetam) and grades 3–4 as higher-dose corticosteroids, anti-seizure medication and intensive care; as throughout this chapter, those regimens apply only per the current product label and institutional protocol.

An implementation detail follows from this. When CRS and ICANS are present at the same time, assessCRS may recommend tocilizumab while assessICANS warns against it. The SDK does not reconcile the two outputs. A user interface that shows them side by side must make the conflict visible and route it to the clinician rather than choosing silently.

7.4 Other Adverse Events

CRS and ICANS dominate attention in the first days, but spec §7.3 covers three further categories that shape monitoring for weeks and sometimes months.

Cytopenias. Low blood counts after cell therapy have several contributors: the lymphodepleting chemotherapy given before infusion (Chapter 6), inflammation during CRS and, in some patients, a prolonged or biphasic course that outlasts the first month. The weekly complete blood count in the specification is a floor, not a ceiling. From a data standpoint the useful record is a time series of counts linked to the infusion date, so that “count recovery” can be computed rather than asserted.

Infections. Lymphodepletion, B-cell aplasia from CD19- or BCMA-directed therapy, low immunoglobulin levels and corticosteroid exposure all raise infection risk. The specification names cytomegalovirus, Epstein–Barr virus and human herpesvirus 6 among viral concerns and lists prophylaxis by category. The immunoglobulin threshold of 400 mg/dL is one of the few numeric triggers in the section; the SDK repeats it as a recommendation string when an active infection event exists. Note that fever during neutropenia and fever from CRS look identical at the bedside, which is one reason the Safety Monitor should never label a fever as CRS by rule alone.

Tumour lysis syndrome. Rapid killing of a large tumour burden can release intracellular potassium, phosphate and nucleic acids faster than the kidneys can clear them. The specification lists preventive hydration, uric-acid lowering agents and frequent laboratory checks for at-risk patients. The SDK has no dedicated type for it; it must be recorded as type: 'other' with a descriptive text, which is adequate for display but weak for analysis. Coding the event with a controlled terminology (see Section 7.6) repairs that weakness.

For every category the reminder stands: the specification lists supportive measures by category, and they apply only per the current product label and institutional protocol.

7.5 The Monitoring Data Model and Risk Rollup

7.5.1 SafetyEvent: one record per adverse event

Where CRSAssessment and ICANSAssessment record repeated observations, SafetyEvent records the event as a whole. Its fields are eventId, patientId, type ('CRS' | 'ICANS' | 'infection' | 'cytopenia' | 'other'), severity (1–5), description, onsetDate, optional resolutionDate, optional free-text treatment, optional outcome ('resolved' | 'resolving' | 'ongoing' | 'fatal'), serious and related.

Three of these fields carry regulatory meaning and deserve careful definitions in any implementation guide:

• severity is an intensity scale of 1 to 5. For CRS and ICANS, the natural choice is to copy the ASTCT grade (1–4) and reserve 5 for death attributed to the event, which matches the convention of the NCI CTCAE for other events. The SDK type for the assessments allows only 0–4, so the mapping must be explicit.
• serious is not the same as severe. In pharmacovigilance, “serious” is a regulatory category defined in ICH E2A (for example an event that results in death, is life-threatening, requires or prolongs hospitalisation, or causes persistent disability). A grade 3 laboratory abnormality may be severe but not serious; a grade 2 event that prolongs a hospital stay may be serious. Keeping the two fields independent, as the type does, is correct; deriving one from the other is not.
• related uses a five-level causality scale from 'definite' to 'unrelated'. The assessment is a clinical judgement, usually by the investigator or treating physician, and the record should store who made it and when.

7.5.2 How monitorSafety rolls events up

monitorSafety(patientId, daysPostInfusion, events) returns a risk level, the active events and a list of recommendation strings. Its logic is short enough to state completely:

1. An event is active if it has no resolutionDate.
2. The risk level is critical if any active event has severity 4 or higher; otherwise high if any active event is serious, or if CRS and ICANS are both active; otherwise moderate if any event is active; otherwise low.
3. Recommendations depend on the day: up to day 10 the patient “should remain hospitalized with continuous monitoring” with CRS and ICANS assessment at least every 4–6 hours; from day 11 to day 30 the patient “should remain within 2 hours of treatment center” with weekly clinic visits. After day 30 the SDK adds no day-based recommendation (the CLI prints “High-risk period passed”).
4. Event-type recommendations are appended: tocilizumab availability and inflammatory markers for CRS; ICE assessment every 4–6 hours and anti-seizure prophylaxis for ICANS; antibiotics and IgG replacement for infection; CBC, G-CSF and transfusion for cytopenia.

import { CellularTherapySDK, SafetyEvent } from '@wia/bio-005';

const sdk = new CellularTherapySDK();
const events: SafetyEvent[] = [
  { eventId: 'AE-0001', patientId: 'PT-7F3A21', type: 'CRS', severity: 2,
    description: 'CRS grade 2 (ASTCT 2019)', onsetDate: new Date('2025-03-14'),
    serious: false, related: 'probable' },
  { eventId: 'AE-0002', patientId: 'PT-7F3A21', type: 'cytopenia', severity: 3,
    description: 'Neutropenia', onsetDate: new Date('2025-03-13'),
    serious: false, related: 'possible' },
  { eventId: 'AE-0003', patientId: 'PT-7F3A21', type: 'other', severity: 1,
    description: 'Nausea on infusion day', onsetDate: new Date('2025-03-11'),
    resolutionDate: new Date('2025-03-12'), serious: false, related: 'possible' },
];

const report = sdk.monitorSafety('PT-7F3A21', 3, events);

// report.riskLevel     -> 'moderate'
// report.activeEvents  -> AE-0001, AE-0002   (AE-0003 has a resolutionDate)
// report.recommendations ->
//   'Patient should remain hospitalized with continuous monitoring'
//   'Assess for CRS and ICANS at least q4-6 hours'
//   'Tocilizumab should be readily available'
//   'Monitor inflammatory markers (CRP, ferritin, IL-6)'
//   'Monitor CBC at least weekly'
//   'G-CSF support for neutropenia'
//   'Transfusion support as needed'

Several behaviours of this rollup need attention in an integration. An event with outcome: 'fatal' but no resolutionDate stays active, while a fatal event given a resolution date drops out of the rollup entirely; a system should treat death as a terminal state of the patient record, not as another event. The ICANS recommendation says “anti-seizure prophylaxis recommended” for any active ICANS event, which is stronger than the specification’s “consider” at grade 2. And the day thresholds reflect the standard’s historical defaults: as discussed in Section 6.8, recent FDA label and REMS changes for approved autologous CAR-T products shortened the post-infusion proximity and driving restrictions to two weeks, and a minimum ten-day inpatient stay is not a regulatory requirement. The monitoring windows should therefore be configuration, set per product and per institution, rather than constants.

7.5.3 The daily assessment panel

Spec §6.4.1 lists what is assessed each day during the early period: vital signs (temperature, blood pressure, heart rate, respiratory rate), a neurological examination including ICE, complete blood count, comprehensive metabolic panel, CRP, ferritin and fibrinogen, and a cytokine panel where available, with vital signs and neurological checks every 4–6 hours. For the data model this means a patient-day record that bundles one or more CRSAssessment and ICANSAssessment observations with the laboratory results, each timestamped and linked to the infusion date so that daysPostInfusion is computed rather than typed. Fibrinogen appears on the list because coagulopathy can accompany severe CRS; it has no field in the SDK types and belongs, like the other laboratory values, in the EHR result store referenced by the monitoring record.

7.6 Integration Architecture

The five required components of spec §8.1 rarely live in a single application. In a realistic deployment they are distributed across the manufacturer, the treating hospital and the organisations that receive safety reports. The standard names four related WIA standards in §10.3: WIA-INTENT (intent-based treatment selection), WIA-OMNI-API (healthcare interoperability), WIA-HEALTH (electronic health records) and WIA-PHARMA (drug safety monitoring). Table 7-6 places each component beside the systems it typically integrates with.

7.6.1 One event, end to end

The sequence below follows one product and one adverse event across organisational boundaries. The steps before infusion were covered in Chapters 3, 5 and 6 and appear here only to show the linkage.

 Manufacturer          Hospital cell lab        Clinical ward / EHR        Pharmacovigilance
 (LIMS/MES, QMS)       (cryo-inventory)         (WIA-HEALTH)               (WIA-PHARMA)
      |                        |                         |                         |
  [1] BatchRelease  ---------> |                         |                         |
      (CoA signed, Ch 3/5)     |                         |                         |
      |                 [2] Receipt + custody            |                         |
      |                     (StorageInfo, C008/C009)     |                         |
      |                        | [3] ThawAndIssue -----> |                         |
      |                        |     (identity, Ch 6)    |                         |
      |                        |                  [4] InfusionRecorded             |
      |                        |                         |  day 0 starts the clock |
      |                        |                  [5] Observations q4-6h           |
      |                        |                      CRSAssessment /              |
      |                        |                      ICANSAssessment              |
      |                        |                  [6] SafetyEvent ---------------> |
      |                        |                         |              [7] case assessed,
      |                        |                         |                  reported per
      | <------------------------------------ [8] product-level signal       jurisdiction
      |   (lot linkage via product_id / batch)           |                         |
      |                        |                         |                         |
   All messages travel through the interoperability layer (WIA-OMNI-API)
   and every hop writes an audit record: who, what, when, which product_id.

Three identifiers hold the flow together. The product_id of the cell product record (Chapter 4) links the bag infused on the ward to its batch record and certificate of analysis. The pseudonymous patientId links observations and events inside the hospital; mapping it to the real identity happens only within the hospital’s own systems. And the eventId of each SafetyEvent becomes the key that pharmacovigilance uses to track follow-up information. Step 8, the return path from a safety signal to a manufacturing lot, is the reason the chain of identity is maintained at all: if several patients who received product from comparable lots show an unexpected pattern, the manufacturer must be able to find those lots.

7.6.2 Vocabulary and message choices

The SDK types are a minimal internal model. When records cross organisational boundaries, established vocabularies make them usable by other systems. Adverse-event terms are commonly coded with MedDRA for regulatory reporting; individual case safety reports are exchanged electronically in the ICH E2B(R3) format; within healthcare IT, HL7 FHIR provides an AdverseEvent resource and observation resources for vital signs and laboratory results. WIA-BIO-005 does not mandate any of these, and the integration layer is the right place to map between them and the SDK types. The practical rule is to keep the original clinical wording, the coded term and the grading scale together in the record, so that a later reader can always see what was observed, how it was coded and on which scale it was graded.

Reporting deadlines to regulators depend on the jurisdiction, the product’s status (clinical trial or marketed) and the event’s seriousness and expectedness. Chapter 8 maps those obligations; the Safety Monitor’s job is to make sure that every event carries the fields needed to decide them.

7.7 Alerting and the Human in the Loop

Everything the SDK emits in this domain is advisory. assessCRS and assessICANS return strings and urgency labels; monitorSafety returns a risk level and recommendations. None of these outputs should place an order, change a dose or close an event by itself. The Safety Monitor’s value lies in making the right information visible to the right person at the right time, and in recording what that person did about it.

The time windows are deliberately left to the institution; the table shows the structure of an escalation design, not recommended values.

7.7.1 Keeping alerts meaningful

Alert fatigue is a real hazard in any monitoring system, and a cell-therapy ward generates many observations per patient per day. Some design choices keep alerts meaningful. Fire on a change of state (a new grade, a new event, a rising risk level) rather than on every observation that repeats a known state. Group simultaneous outputs for one patient into a single notification with the conflict highlighted. Suppress duplicate day-based reminders once they have been acknowledged for that patient and day. And never raise an alert from a biomarker threshold alone, for the reasons given in Section 7.1.4.

7.7.2 Audit trail

Every grade, acknowledgement and override should produce an audit entry that records who acted, in which role, when, on which patient and which product, what the system displayed at that moment (including the SDK version and the strings returned), and what the person decided. Storing the displayed strings matters because recommendation text can change between SDK releases; an auditor must be able to see what the clinician actually saw. The same trail answers the pharmacovigilance question of when the organisation first became aware of an event, which starts reporting clocks in many jurisdictions.

7.7.3 A short pre-go-live checklist

• CRS and ICANS grades are computed from structured fields per ASTCT 2019, not typed as a number and passed through.
• ICE is captured by the five ASTCT domains, and the specification erratum is documented in the validation file.
• Tocilizumab dose counting against the label limits is performed by the prescribing system.
• Monitoring windows (inpatient period, proximity, clinic frequency) are configured per product and institution, not taken from SDK constants.
• severity and serious are entered independently, and related records who assessed causality.
• Conflicting outputs are displayed as conflicts, and every alert, acknowledgement and override is in the audit trail with the SDK version.